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The Association of Consumer Support Organisations (ACSO) Submission to the Information 


Commissioner’s Office Consultation on the ‘Draft Direct Marketing Code of Practice’ 


The Association of Consumer Support Organisations (ACSO) welcomes the opportunity to 
respond to the Information Commissioner’s Office (ICO) consultation on the ‘draft direct 
marketing code of practice’. 


ACSO was established in January 2019 to represent the interests of consumers in the civil 
justice system and the reputable, diverse range of organisations who are united in providing 
the highest standards of service in support of those consumers. Its role is to engage with 
policymakers, regulators, industry and the media to ensure there is a properly functioning, 
competitive and sustainable civil justice system for honest consumers. 


Our response will focus upon the implications of the direct marketing code upon consumers, 
in particular, how to ensure they are aware of their rights and able to utilise the protections 
offered by the code. 


As such, we welcome the ICO’s repeated reiteration of consumer rights in regard to the use 
of personal data, namely the rights to be informed, to objection, rectification, erasure and 
access. In addition, an adequate overview, including signposting to other regulatory bodies, 
has been provided to outline the repercussions an organisation will face if it does not comply 
with the code. 


There has been a lack of direct engagement with consumers and consumer groups in the 
formulation of the direct marketing code. Such engagement would serve to improve the 
understanding of consumer attitudes towards the collection and use of private data, as well 
as consumer ideas on what measures could be put in place to meet their needs. 


Finally, we wish to emphasise our support of the code, the creation of which serves to clarify 
the rules of direct marketing. As such, we welcome the ICO’s statement that “adherence to 
this code will be a key measure of [organisations] compliance with data protection”. 


Q1 Is the draft code clear and easy to understand? 


Yes. The language used to outline the code, and to explain the underlying legal framework, is 
clear, concise and written in plain English. 


However, we urge the ICO to consider ways to improve information accessibility for all 
consumers, with a particular focus upon the most vulnerable in society. For example, the code 
should be made available in audio, braille and hardback copies upon request. This will help 
ensure that information on individual rights in regard to personal data is accessible to the 
widest range of consumers. 


The ICO has stated that the code assumes familiarity with key data protection and Privacy and 
Electronic Communications Regulation (PECR) concepts, however we welcome the inclusion 


of linked resources and reading suggestions as a means to provide context and further 
guidance on specific issues. 


In addition, we commend the ICO for outlining perceived ‘loop-holes’ within the direct 
marking code, such as ‘sugging’ (selling under the guise of research) or by using a neutral tone 
when communicating with consumers. This helps to ensure that no organisation avoids the 
direct marketing rules by such means, and that consumers may be aware when an 
organisation is attempting to do so. 


Q2 Does the draft code contain the right level of detail? (When answering please 
remember that the code does not seek to duplicate all our existing data protection and 
e-privacy guidance) 


Yes. Although we urge the ICO to provide clear, succinct information, specifically tailored 
towards consumers, on data privacy rights. 


If consumers are not aware of the rights they hold in regard to their personal information, 
they will be unable to utilise the protections offered by the code. Data collection is an integral 
part of the digital age. As such, we urge the ICO to conduct further research on how best to 
educate the public on data privacy rights, how data may be used and the value of private 
data. 


Q3 Does the draft code cover the right issues about direct marketing? 


In general, yes. However, as mentioned above, we note the absence of any direct consumer 
engagement in the formulation of the draft direct marketing code. Effective dialogue 
between the ICO and consumers would help ensure the code, and the outcomes it delivers, 
are designed around consumer needs. In particular, it would lead to the creation of a code 
that addresses the particular challenges consumers are likely to face. 


Understanding how consumers can and do engage with direct marketing should be a central 
component in the formulation of the code. There exists a lack of detailed analysis on how key 
concepts such as trust, concern, privacy, value and control in personal data are interpreted 
by consumers. Any lack of clarity on terms and definitions is likely to serve as a barrier to 
developing a code that works in the best interest of consumers, and to the assessment of the 
success and value of the code. As such, we urge the ICO to engage directly with consumers 
and consumer-focused groups. 


Q4 Does the draft code address the areas of data protection and e-privacy that are having 
an impact on your organisation’s direct marketing practices? 


Yes. We acknowledge the repeated emphasis on accountability within General Data 
Protection Regulation (GDPR) and PECR, thereby placing the onus on an organisation to 
demonstrate compliance, such as through the conduction of a data protection impact 
assessment (DPIA). 


We note that GDPR does not specify the length of time an organisation should keep personal 
data for direct marketing purposes. The storage limitation principle states that data must not 
be kept for longer than needed and it is the responsibility of each organisation to determine 
and justify the length of time personal data is stored, however further clarification from the 
ICO would be welcome. 


Q5 Isit easy to find information in the draft code? 


Yes. In particular, we commend the specific section within the code on marketing targeted 
directly at children. Children represent a more vulnerable group of society, as recognised by 
Recital 38 of the GDPR: “Children merit specific protection within regard to their personal 
data, as they may be less aware of the risks, consequences and safeguards concerned and 
their rights in relation to the processing of personal data.” As the digital landscape continues 
to evolve at a rapid pace, and children become exposed to online risks at an ever-younger 
age, it is vital that that rules on marketing to children are clear and easy to find. 


We do, however, strongly urge the ICO to consider the inclusion of a section within the code 
specifically aimed for consumers. This should provide clear, concise information on data 
privacy rights including how consumers can exercise their rights in regard to objection, 


erasure and access of their data. 


Q6 Do you have any examples of direct marketing in practice, good or bad, that you think it 
would be useful to include in the code? 


No. 
Q7 Do you have any other suggestions for the direct marketing code? 


We reiterate the need for direct engagement with consumers and consumer groups in 
addition to research on how best to communicate data protection rights to the public. 


Q8 Are you answering as: 


This submission has been written on behalf of the Association of Consumer Support 
Organisations (ACSO). 


Q9. How did you find out about this survey? 


Via the ICO website. 
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For further information, please contact: 


The Association of Consumer Support Organisations (ACSO) 
acso.org.uk 


